CVE-2026-12003
Full vulnerability record from the local CVENow database.
Description
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources. Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory. The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.
View original CVE JSON
{
"id": "CVE-2026-12003",
"sourceIdentifier": "[email protected]",
"published": "2026-06-16T17:16:31.667",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "To allow builds of Python to be run from an in-tree layout (rather than\nan installed file layout), the VPATH variable is defined at build time\nand used to locate certain landmarks - specifically,\nModules/setup.local. When this landmark is found relative to VPATH\nrelative to the executable, Python assumes it is running in a source\ntree and generates a different default sys.path. This code remains in\nrelease builds, so that release-ready builds can be built in-tree.\n\nOn Windows, since builds are written to 'PCbuild/', the value of\nVPATH is set to '..\\..', which results in a landmark of\n'..\\..\\Modules\\setup.local'. This path is outside the install directory\nof Python, and may have different permissions, potentially allowing a\nlow-privilege user to create the landmark and an alternative `Lib`\nfolder that will be discovered by an otherwise restricted install.\n\nSuch a setup occurs with the legacy default install location for all\nusers (in the now superseded EXE installer), due to how Windows allows\nall users to create folders in the root directory of their OS drive.\n\nOur recommended mitigation on Windows is to migrate away from the\nlegacy installer and use the new [Python install\nmanager](https://www.python.org/downloads/latest/pymanager/) to install\nfor the current user. Installs where the directory two levels above the\nPython installation directory have equivalent permissions are unaffected\n(in general, a per-user install cannot be modified at all by other\nusers, removing any escalation of privilege risk, and could be directly\nmodified by a privileged user, making the potential tampering\nirrelevant). Alternative mitigations might include preemptively creating\nand restricting access to a `Modules` directory. Be aware that only 3.13\nand 3.14 will receive updated legacy installers - earlier fixes are only\nprovided as sources.\n\nPlatforms other than Windows allow VPATH to be overridden, but as they\ndon't usually use a separated directory in the build for binaries, are\nunlikely to have a landmark reference outside of the install directory.\n\nThe landmark detection involving VPATH is a fallback for when a more\nspecific landmark - .\\pybuilddir.txt - is absent, and was included for\ncompatibility. Future releases of Python will no longer include the\nfallback, and so builds will need to generate or preserve the\npybuilddir.txt file in order to work in-tree. This landmark file has\nbeen generated on Windows since 3.11, and on other platforms for longer."
},
{
"lang": "es",
"value": "Para permitir que las compilaciones de Python se ejecuten desde un diseño en árbol (en lugar de un diseño de archivo instalado), la variable VPATH se define en tiempo de compilación y se utiliza para localizar ciertos puntos de referencia - específicamente, Modules/setup.local. Cuando este punto de referencia se encuentra en relación con VPATH en relación con el ejecutable, Python asume que se está ejecutando en un árbol de código fuente y genera un sys.path predeterminado diferente. Este código permanece en las compilaciones de lanzamiento, de modo que las compilaciones listas para lanzamiento puedan construirse en el árbol.\n\nEn Windows, dado que las compilaciones se escriben en ’PCbuild/’, el valor de VPATH se establece en ’.. / ..’, lo que resulta en un punto de referencia de ’.. / .. / Modules\\setup.local’. Esta ruta está fuera del directorio de instalación de Python y puede tener permisos diferentes, lo que podría permitir a un usuario con pocos privilegios crear el punto de referencia y una carpeta ’Lib’ alternativa que será descubierta por una instalación que de otro modo estaría restringida.\n\nTal configuración ocurre con la ubicación de instalación predeterminada heredada para todos los usuarios (en el instalador EXE ahora obsoleto), debido a cómo Windows permite a todos los usuarios crear carpetas en el directorio raíz de su unidad de sistema operativo.\n\nNuestra mitigación recomendada en Windows es migrar del instalador heredado y usar el nuevo [gestor de instalación de Python](https://www.python.org/downloads/latest/pymanager/) para instalar para el usuario actual. Las instalaciones donde el directorio dos niveles por encima del directorio de instalación de Python tienen permisos equivalentes no se ven afectadas (en general, una instalación por usuario no puede ser modificada en absoluto por otros usuarios, eliminando cualquier riesgo de escalada de privilegios, y podría ser modificada directamente por un usuario privilegiado, haciendo que la posible manipulación sea irrelevante). Mitigaciones alternativas podrían incluir la creación preventiva y la restricción de acceso a un directorio ’Modules’. Tenga en cuenta que solo las versiones 3.13 y 3.14 recibirán instaladores heredados actualizados; las correcciones anteriores solo se proporcionan como código fuente.\n\nOtras plataformas distintas de Windows permiten que VPATH sea anulado, pero como no suelen usar un directorio separado en la compilación para los binarios, es poco probable que tengan una referencia de punto de referencia fuera del directorio de instalación.\n\nLa detección de puntos de referencia que involucra VPATH es un mecanismo de reserva para cuando un punto de referencia más específico - .\\pybuilddir.txt - está ausente, y se incluyó por compatibilidad. Las futuras versiones de Python ya no incluirán el mecanismo de reserva, por lo que las compilaciones deberán generar o preservar el archivo pybuilddir.txt para funcionar en el árbol. Este archivo de punto de referencia se ha generado en Windows desde la versión 3.11, y en otras plataformas desde hace más tiempo."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Python Software Foundation",
"product": "CPython",
"defaultStatus": "unaffected",
"repo": "https://github.com/python/cpython",
"versions": [
{
"version": "0",
"lessThan": "3.11.16",
"versionType": "python",
"status": "affected"
},
{
"version": "3.12.0",
"lessThan": "3.12.14",
"versionType": "python",
"status": "affected"
},
{
"version": "3.13.0",
"lessThan": "3.13.15",
"versionType": "python",
"status": "affected"
},
{
"version": "3.14.0",
"lessThan": "3.14.7",
"versionType": "python",
"status": "affected"
},
{
"version": "3.15.0a1",
"lessThan": "3.15.0b3",
"versionType": "python",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-16T17:53:54.916961Z",
"id": "CVE-2026-12003",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-427"
}
]
}
],
"references": [
{
"url": "https://github.com/python/cpython/commit/03ab7b44788bfd6b8927e16bcdbd025aa08dce06",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/16c40f944b7bff724a403cf4902763d095bb4b2a",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/872038377db2e170e0e140b5f8aaedf636b3fbf5",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/9e863fab283eddca9c2a8f9d1ee30f4dc243e314",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/a86de0bc236fbb9452f98998fc8437e9fca35700",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/commit/b93d6d3399adbd3a5037b6b92fc3587c85ac5d56",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/issues/151544",
"source": "[email protected]"
},
{
"url": "https://github.com/python/cpython/pull/151545",
"source": "[email protected]"
},
{
"url": "https://https://mail.python.org/archives/list/[email protected]/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH/",
"source": "[email protected]"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/16/8",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}